Systems and/or methods for generating reassemblable disassemblies of binaries using declarative logic

A system for disassembling an executable, comprising:

• a non-transitory computer readable storage medium;
• and
• processing resources including at least one memory and a hardware processor, the processing resources being configured to:
• receive the executable;
• parse the executable, and decode possible instructions in the executable in connection with the parsing;
• generate an initial fact database comprising the possible instructions, the initial fact database being stored to the non-transitory computer readable storage medium;
• generate an enhanced fact database by executing a plurality of inference modules on the initial fact database, at least some of the inference modules being expressed in a declarative query language and including (a) a code inference module structured to compute valid instructions organized in blocks of code, (b) a symbolization module structured to disambiguate between symbols and memory addresses, and (c) a function inference module structured to identify functions, the enhanced fact database being stored to the non-transitory computer readable storage medium;
• and
• organize content from the enhanced fact database into a format of valid assembler code,
• wherein one or more of the inference modules implement(s) a soft heuristic by:
• generating a problem/solution space for the issue for which evidence is to be built and/or for which a conflict is to be resolved;
• subjecting at least some of the members in the problem/solution space to rules that assign points to different outcomes related to the issue for which the evidence is to be built and/or for which the conflict is to be resolved;
• determining which one or more members of the problem/solution space has/have the most points;
• and
• admitting to the enhanced fact database the one or more members of the problem/solution space determined to have the most points;
• and
• wherein one or more of the inference modules implement(s) the soft heuristic in addition to hard rules for fact generation, the hard rules and soft heuristic(s) being encoded into declarative relations.

A non-transitory computer readable storage medium tangibly storing a program that, when executed by a computing system including at least one processor, is configured to disassemble an executable, by performing functionality comprising:

• parsing the executable, and decoding possible instructions in the executable in connection with the parsing;
• generating an initial fact database comprising the possible instructions;
• generating an enhanced fact database by executing a plurality of inference modules on the initial fact database, at least some of the inference modules being expressed in a declarative query language and including (a) a code inference module structured to compute valid instructions organized in blocks of code, (b) a symbolization module structured to disambiguate between symbols and memory addresses, and (c) a function inference module structured to identify functions;
• and
• organizing content from the enhanced fact database into a format of valid assembler code,
• wherein one or more of the inference modules implement(s) a soft heuristic by:
• generating a problem/solution space for the issue for which evidence is to be built and/or for which a conflict is to be resolved;
• subjecting at least some of the members in the problem/solution space to rules that assign points to different outcomes related to the issue for which the evidence is to be built and/or for which the conflict is to be resolved;
• determining which one or more members of the problem/solution space has/have the most points;
• and
• admitting to the enhanced fact database the one or more members of the problem/solution space determined to have the most points;
• and
• wherein one or more of the inference modules implement(s) the soft heuristic in addition to hard rules for fact generation, the hard rules and soft heuristic(s) being encoded into declarative relations.